Skip to main content

Confluence Server CVE-2023-22504

MEDIUM
Unrestricted Upload of File with Dangerous Type (CWE-434)
2023-05-25 security@atlassian.com
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
May 25, 2023 - 14:15 nvd
MEDIUM 6.5

DescriptionNVD

Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature.

AnalysisAI

Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature. Affected products include: Atlassian Confluence Server.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

CVE-2012-2926 CRITICAL POC
9.1 May 22

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible bef

CVE-2023-22518 CRITICAL POC
9.8 Oct 31

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Rated critical severit

CVE-2022-26134 CRITICAL POC
9.8 Jun 03

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

CVE-2024-21683 HIGH POC
8.8 May 21

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and

CVE-2019-3398 HIGH POC
8.8 Apr 18

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. Rated high

CVE-2017-7415 HIGH POC
7.5 Apr 27

Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the

CVE-2012-6342 MEDIUM POC
6.8 May 13

Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers t

CVE-2022-26136 CRITICAL
9.8 Jul 20

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used

CVE-2019-3395 CRITICAL
9.8 Mar 25

The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), f

CVE-2021-26085 MEDIUM POC
5.3 Aug 03

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriza

CVE-2024-21677 HIGH
8.8 Mar 19

This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. Rated high s

CVE-2024-21673 HIGH
8.8 Jan 16

This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center

Share

CVE-2023-22504 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy